fix(plane): reject dot-segment IDs in request paths

encodeURIComponent leaves . and .. intact, so an ID of .. collapsed the
URL onto the parent resource (a work item delete could target its
project). Every slug and ID segment now goes through validatePathSegment.

Author: mzxchandra

apps/sim/lib/internal/plane/operations.ts

@@ -23,6 +23,7 @@ import {
   mapPlaneAttachment,
   normalizePlaneBaseUrl,
   planeHeaders,
+  planePathSegment,
   planeWorkItemUrl,
 } from '@/tools/plane/utils'
 
@@ -131,7 +132,7 @@ async function discardPendingAttachment(
 ) {
   try {
     const response = await planeRequest(
-      planeWorkItemUrl(input, `attachments/${encodeURIComponent(assetId)}/`),
+      planeWorkItemUrl(input, `attachments/${planePathSegment(assetId, 'attachmentId')}/`),
       { method: 'DELETE', apiKey: input.apiKey },
       signal
     )
@@ -256,7 +257,7 @@ export async function executePlaneUploadAttachment(
     await uploaded.body?.cancel().catch(() => {})
 
     const confirmed = await planeRequest(
-      planeWorkItemUrl(input, `attachments/${encodeURIComponent(ticket.assetId)}/`),
+      planeWorkItemUrl(input, `attachments/${planePathSegment(ticket.assetId, 'attachmentId')}/`),
       { method: 'PATCH', apiKey: input.apiKey, body: { is_uploaded: true } },
       context.signal
     )

apps/sim/tools/plane/add_work_items_to_cycle.ts

@@ -42,7 +42,10 @@ export const planeAddWorkItemsToCycleTool: ToolConfig<
 
   request: {
     url: (params) =>
-      planeProjectUrl(params, `cycles/${planePathSegment(params.cycleId)}/cycle-issues/`),
+      planeProjectUrl(
+        params,
+        `cycles/${planePathSegment(params.cycleId, 'cycleId')}/cycle-issues/`
+      ),
     method: 'POST',
     headers: planeHeaders,
     body: (params) => {

apps/sim/tools/plane/add_work_items_to_module.ts

@@ -44,7 +44,10 @@ export const planeAddWorkItemsToModuleTool: ToolConfig<
 
   request: {
     url: (params) =>
-      planeProjectUrl(params, `modules/${planePathSegment(params.moduleId)}/module-issues/`),
+      planeProjectUrl(
+        params,
+        `modules/${planePathSegment(params.moduleId, 'moduleId')}/module-issues/`
+      ),
     method: 'POST',
     headers: planeHeaders,
     body: (params) => {

apps/sim/tools/plane/delete_attachment.ts

@@ -34,7 +34,10 @@ export const planeDeleteAttachmentTool: ToolConfig<
 
   request: {
     url: (params) =>
-      planeWorkItemUrl(params, `attachments/${planePathSegment(params.attachmentId)}/`),
+      planeWorkItemUrl(
+        params,
+        `attachments/${planePathSegment(params.attachmentId, 'attachmentId')}/`
+      ),
     method: 'DELETE',
     headers: planeHeaders,
   },

apps/sim/tools/plane/delete_comment.ts

@@ -30,7 +30,8 @@ export const planeDeleteCommentTool: ToolConfig<PlaneDeleteCommentParams, PlaneD
   },
 
   request: {
-    url: (params) => planeWorkItemUrl(params, `comments/${planePathSegment(params.commentId)}/`),
+    url: (params) =>
+      planeWorkItemUrl(params, `comments/${planePathSegment(params.commentId, 'commentId')}/`),
     method: 'DELETE',
     headers: planeHeaders,
   },

apps/sim/tools/plane/delete_link.ts

@@ -30,7 +30,8 @@ export const planeDeleteLinkTool: ToolConfig<PlaneDeleteLinkParams, PlaneDeleteR
   },
 
   request: {
-    url: (params) => planeWorkItemUrl(params, `links/${planePathSegment(params.linkId)}/`),
+    url: (params) =>
+      planeWorkItemUrl(params, `links/${planePathSegment(params.linkId, 'linkId')}/`),
     method: 'DELETE',
     headers: planeHeaders,
   },

apps/sim/tools/plane/delete_work_item.ts

@@ -25,7 +25,8 @@ export const planeDeleteWorkItemTool: ToolConfig<PlaneDeleteWorkItemParams, Plan
   },
 
   request: {
-    url: (params) => planeProjectUrl(params, `work-items/${planePathSegment(params.workItemId)}/`),
+    url: (params) =>
+      planeProjectUrl(params, `work-items/${planePathSegment(params.workItemId, 'workItemId')}/`),
     method: 'DELETE',
     headers: planeHeaders,
   },

apps/sim/tools/plane/download_attachment.ts

@@ -42,7 +42,10 @@ export const planeDownloadAttachmentTool: ToolConfig<
 
   request: {
     url: (params) =>
-      planeWorkItemUrl(params, `attachments/${planePathSegment(params.attachmentId)}/`),
+      planeWorkItemUrl(
+        params,
+        `attachments/${planePathSegment(params.attachmentId, 'attachmentId')}/`
+      ),
     method: 'GET',
     headers: (params) => ({ 'X-API-Key': params.apiKey.trim(), Accept: '*/*' }),
     responseType: 'binary',

apps/sim/tools/plane/get_project.ts

@@ -24,7 +24,8 @@ export const planeGetProjectTool: ToolConfig<PlaneGetProjectParams, PlaneProject
   },
 
   request: {
-    url: (params) => planeWorkspaceUrl(params, `projects/${planePathSegment(params.projectId)}/`),
+    url: (params) =>
+      planeWorkspaceUrl(params, `projects/${planePathSegment(params.projectId, 'projectId')}/`),
     method: 'GET',
     headers: planeHeaders,
   },

apps/sim/tools/plane/get_work_item.ts

@@ -26,7 +26,8 @@ export const planeGetWorkItemTool: ToolConfig<PlaneGetWorkItemParams, PlaneWorkI
   },
 
   request: {
-    url: (params) => planeProjectUrl(params, `work-items/${planePathSegment(params.workItemId)}/`),
+    url: (params) =>
+      planeProjectUrl(params, `work-items/${planePathSegment(params.workItemId, 'workItemId')}/`),
     method: 'GET',
     headers: planeHeaders,
   },